[Question] Storing Secrets via ECS Fargate?

[araphiel]

Summary

I'm looking to store secrets in:

• ecs-params.yml (subnets, security groups, etc)
• docker-compose.yml (env variables)

What is the defacto way to safely store secrets using ECS Fargate?

[rebyn]

The just-released, officially-endorsed way would be AWS Systems Manager Parameter Store. You can find the announcement and links to relevant docos here: https://aws.amazon.com/about-aws/whats-new/2018/12/aws-fargate-platform-version-1-3-adds-secrets-support/.

[allisaurus]

@rebyn that's correct! One additional note for use with the ecs-cli is that we always use the LATEST platform version for Fargate, and this new platform version will be rolling out as acting LATEST through the end of the week. You can find more detail in that article you linked :)

@araphiel the ecs-cli currently supports use of ECS Secrets via the ecs-params.yml (see secrets under services)

[araphiel]

The timing on this news is amazing!

Thank you @allisaurus @rebyn

[kueben]

EDIT:
for others who ran into this, it seems secrets manager is not currently supported, whereas SSM parameter store is (which is working with the setup as described below)

Hi, I am attempting to use ecs-params.yml secrets on fargate via ecs-cli. I run into the error: The specified platform does not satisfy the task definition’s required capabilities. as people are saying here aws/amazon-ecs-agent#1209.

@allisaurus @rebyn @araphiel Do you have experience with this working?

I am running the following ecs-cli command:
compose --cluster $ECS_CLUSTER --file docker-compose.staging.yml service up --launch-type FARGATE --timeout 15

Here is my ECS params for reference:

task_definition:
  task_execution_role: ecsTaskExecutionRole
  ecs_network_mode: awsvpc
  task_size:
    mem_limit: 0.5GB
    cpu_limit: 256
  services:
    node:
      secrets:
        - value_from: ${SECRETS_ARN_JWT}
          name: "JWT_TOKEN"
run_params:
  network_configuration:
    awsvpc_configuration:
      subnets:
        - ${ECS_CLUSTER_SUBNET_1}
        - ${ECS_CLUSTER_SUBNET_1}
      security_groups:
        - ${ECS_CLUSTER_SECURITY_GROUP}
      assign_public_ip: ENABLED